Comment 2 for bug 1528904
Revision history for this message
| Kamal Mostafa (kamalmostafa) wrote Re: overlay getattr vulnerability | #2 |
© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
73416ba
(Get the code!)
[corrected]:
The fix commit (acff81e "ovl: fix permission checking for setattr") applies cleanly to Vivid (already committed), Wily, and Xenial.
By code inspection, it appears to me that the older version of overlayfs in releases <= Utopic is not vulnerable to this exploit: their ovl_setattr() already calls a copy_up first thing, like the fix patch does.